6721 matches found
CVE-2018-15774
Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in th...
Critical: Red Hat Security Advisory: OpenShift Container Platform 3.4 security update
An update is now available for Red Hat OpenShift Container Platform release 3.4. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...
CVE-2018-1002000
There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the delids variable by POST request...
Remote Code Execution (RCE)
phpbb/phpbb is vulnerable to a remote code execution RCE attack. The vulnerability exists because the library defines an absolute path when importing the ImageMagick library. A malicious user with admin access permission is allowed to pass a .phar file that when deserialized, injects and executes...
Design/Logic Flaw
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...
TIBCO ActiveSpaces administrative daemon component cross-site request forgery vulnerability
TIBCO ActiveSpaces is a TIBCO solution for in-memory computing, in-memory data grids, and fault-tolerant datastores. administrative daemon tibdgadmind is one of the daemon components. A cross-site request forgery vulnerability exists in the administrative daemon component in TIBCO ActiveSpaces. A...
PhpTpoint Hospital Management System SQL Injection Vulnerability (CNVD-2019-23086)
PhpTpoint Hospital Management System is a hospital management system developed using PHP language. The system includes functions such as doctor management, patient management and online appointment booking. A SQL injection vulnerability exists in PhpTpoint Hospital Management System, which can be...
PT-2018-4938 · Red Hat · Jboss Bpm Suite
Name of the Vulnerable Software and Affected Versions: JBoss BPM Suite 6 Description: The issue allows remote attackers to perform a reflected XSS attack via dashbuilder. This can be achieved by enticing authenticated users, typically admins, to click on malicious links to the...
phptpoint Pharmacy Management System 1.0 - username SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: phptpoint Pharmacy Management System 1.0 - 'username' SQL injection Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link:...
CVE-2018-18832
admin/check.asp in DKCMS 9.4 allows SQL Injection via an ASPSESSIONID cookie to admin/admin.asp...
phptpoint Hospital Management System 1.0 - user SQL injection
phptpoint Hospital Management System 1.0 - user SQL injection Exploit Title: phptpoint Hospital Management System 1.0 - 'user' SQL injection Date: 2018-10-24 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link: Version: 1...
Advantech WebAccess Improper Privilege Management Vulnerability
Advantech WebAccess software is the core of Advantech's IoT application platform solution, providing users with a user interface based on HTML5 technology for a cross-platform, cross-browser data access experience. An improper privilege management vulnerability exists in Advantech WebAccess. An...
GUI Elevation of Privilege Vulnerability in Multiple IBM Products
IBM FlashSystem 840 MTMs 9840-AE1 and others are enterprise-class storage solutions from IBM USA. The solution offers a full suite of disaster recovery tools including snapshots, cloning, and replication to secure data as well as virtualized configuration and performance management using IBM...
Citrix NetScaler Management and Analytics System Default Administrator Credentials
The remote Citrix NetScaler Management and Analytics System MAS uses a default password 'nsroot' for the administrator account 'nsroot'. With this information, an attacker can gain complete administrative access to the Citrix NetScaler appliance. %NASLMINLEVEL 70300 C Tenable Network Security, In...
Cisco Prime Collaboration Provisioning Trust Management Vulnerability
Cisco Prime Collaboration Provisioning PCP is a set of Web-based, next-generation communications services software from Cisco. The software provides IP communication service features for IP telephony, voice mail and unified communications environments. A trust management vulnerability exists in t...
DEBIAN-CVE-2018-16587
In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a user with admin permissions opens it, it causes deletions of arbitrary files that the OTRS web server user has write access to...
Western Digital's My Cloud NAS Devices Turn Out to Be Easily Hacked
Security researchers have discovered an authentication bypass vulnerability in Western Digital's My Cloud NAS devices that potentially allows an unauthenticated attacker to gain admin-level control to the affected devices. Western Digital's My Cloud WD My Cloud is one of the most popular...
WesternDigital #MyCloud Authentication Bypass Vulnerability
It was discovered that the Western Digital My Cloud is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the My Cloud device. This...
CVE-2018-17153
CVE-2018-17153 affects Western Digital My Cloud devices older than 2.30.196. An unauthenticated attacker can bypass authentication and become admin by abusing the network_mgr.cgi flow; after session creation, commands normally requiring admin privileges succeed if the cookie username=admin is set...
